ssh fiddlings

flake.nix

@@ -196,7 +196,7 @@
                 inputs.clan-core.clanModules.static-hosts
                 # generate ssh host keys with facts
                 # fixme: not working
-                # inputs.clan-core.clanModules.sshd
+                inputs.clan-core.clanModules.sshd
               ];
               documentation.nixos.enable = true;
               clan.static-hosts.topLevelDomain = "bear";
@@ -341,8 +341,7 @@
 
           cream = clanSetup {
             name = "cream";
-            host = "cream";
-            #host = "cream.bear";
+            host = "cream.bear";
             modules = [
               nixos-hardware.nixosModules.framework-12th-gen-intel
               retiolum.nixosModules.retiolum
@@ -363,8 +362,7 @@
 
           cherry = clanSetup {
             name = "cherry";
-            #host = "cherry.bear";
-            host = "cherry";
+            host = "cherry.bear";
             modules = [
               nixos-hardware.nixosModules.framework-13th-gen-intel
               homeManagerModules
@@ -383,8 +381,7 @@
 
           chungus = clanSetup {
             name = "chungus";
-            #host = "chungus.bear";
-            host = "chungus";
+            host = "chungus.bear";
             modules = [
               {
                 clan.networking.zerotier.controller = {
@@ -410,9 +407,8 @@
 
           orbi = clanSetup {
             name = "orbi";
-            #host = "orbi.bear";
-            host = "95.216.66.212";
-            #host = "10.100.0.1";
+            host = "orbi.bear";
+            #host = "95.216.66.212";
             modules = [
               homeManagerModules
               stylixModules

nixos/components/network/default.nix

@@ -18,6 +18,7 @@ with types;
     ./tinc
     ./wifi.nix
     ./wireguard.nix
+    ./zerotier.nix # todo: sshd must be first managed by clan
   ];
 
   config = mkIf config.components.network.enable { };

nixos/components/network/syncthing.nix

@@ -1,6 +1,5 @@
 { config, lib, pkgs, factsGenerator, ... }:
 let
-
   machineDir = "${config.clanCore.clanDir}/machines";
   syncthingPub = machine:
     lib.removeSuffix "\n"

nixos/components/network/zerotier.nix

@@ -0,0 +1,26 @@
+{ lib, config, ... }:
+let
+  machineDir = "${config.clanCore.clanDir}/machines/";
+  publicKey = machine: (builtins.readFile "${machineDir}/${machine}/facts/ssh.id_ed25519.pub");
+  machinesFileSet = builtins.readDir machineDir;
+  machines = lib.mapAttrsToList (name: _: name) machinesFileSet;
+  tld = config.clan.static-hosts.topLevelDomain;
+  knownHosts = lib.mapAttrs
+    (name: _:
+      {
+        hostNames = [
+          "[${name}]:2222"
+          "[${name}.${tld}]:2222"
+          "[${name}.private]:2222"
+          "${name}"
+          "${name}.${tld}"
+          "${name}.private"
+        ];
+        publicKey = publicKey name;
+      }
+    )
+    machinesFileSet;
+in
+{
+  services.openssh.knownHosts = knownHosts;
+}

nixos/machines/chungus/sync-syncoid.nix

@@ -1,7 +1,18 @@
 { pkgs, config, factsGenerator, ... }:
+let
+  tld = config.clan.static-hosts.topLevelDomain;
+in
 {
 
   clanCore.facts.services.syncoid = factsGenerator.ssh { name = "syncoid"; };
+  systemd.tmpfiles.settings.syncoid = {
+    "/run/facts/ssh.syncoid.id_ed25519"."C+" = {
+      user = config.services.syncoid.user;
+      group = config.services.syncoid.group;
+      mode = "400";
+      argument = config.clanCore.facts.services.syncoid.secret."ssh.syncoid.id_ed25519".path;
+    };
+  };
 
   services.syncoid = {
     enable = true;
@@ -22,18 +33,18 @@
 
     # remote
     commands.matrix-terranix = {
-      sshKey = config.clanCore.facts.services.syncoid.secret."ssh.syncoid.id_ed25519".path;
-      source = "root@orbi:zroot/matrix-terranix";
+      sshKey = "/run/facts/ssh.syncoid.id_ed25519";
+      source = "root@orbi.${tld}:zroot/matrix-terranix";
       target = "zraid/mirror/matrix-terranix"; # should not be created up front!
     };
     commands.nextcloud = {
-      sshKey = config.clanCore.facts.services.syncoid.secret."ssh.syncoid.id_ed25519".path;
-      source = "root@orbi:zroot/nextcloud";
+      sshKey = "/run/facts/ssh.syncoid.id_ed25519";
+      source = "root@orbi.${tld}:zroot/nextcloud";
       target = "zraid/mirror/nextcloud"; # should not be created up front!
     };
     commands.photoprism = {
-      sshKey = config.clanCore.facts.services.syncoid.secret."ssh.syncoid.id_ed25519".path;
-      source = "root@orbi:zmedia/photoprism";
+      sshKey = "/run/facts/ssh.syncoid.id_ed25519";
+      source = "root@orbi.${tld}:zmedia/photoprism";
       target = "zraid/mirror/photoprism"; # should not be created up front!
     };
     commonArgs = [